Government Responses to RFI Questions.docx

GOVERNMENT RESPONSES TO QUESTIONS RECEIVED IN RESPONSE TO THE ENTERPRISE LOGGING INGEST AND CYBER SITUATIONAL AWARENESS REFINERY (ELICSAR) VULNERABILITY ASSESSMENT & LEARNING - AUTOMATED REMEDIATION (VALAR) REQUEST FOR INFORMATION (RFI) Date: 20 November 2025

Question RFI Letter § 3.B; Attachment 1 – Required Fields Should respondents complete every tab and field in Attachment 1? If some fields are not applicable, do you prefer “N/A”, a brief rationale, or leaving the cell blank?

Government Response

"N/A” is acceptable.

Question RFI Letter § 6 – Demonstration Opportunity What format/length is envisioned for one-on-one demos (e.g., 60–90 minutes)?

Will a sanitized dataset or Government-provided scenario be supplied, and may the demo environment run in our tenant?

Government Response

To be determined should the Government pursue a demonstration.

Question Submission Logistics Please confirm submission method (email only) and any file constraints (max size per email, required file types, password protection for CUI). If multiple emails are needed, how should subjects be labeled to ensure proper receipt?

Government Response

All responses must be captured on Attachment 1 of the RFI. If you have already submitted a response and have not received a request for revision, your submission has been deemed acceptable. Vendors have leverage to label emails as fit while identifying the company and RFI title.

Question Small Business & Socioeconomic Considerations

Will the Government collect or consider small-business participation approaches at the RFI stage (e.g., suggested set-aside strategy, teaming constructs), or should that be deferred to any future solicitation?

Government Response

RFI is open to all size standards.

Question

Would AFLCMC/HNCK be open to an early capability discussion or technical exchange session?

Government Response

Per RFI the Government may pursue a demonstration.

Question

Are you able to provide clarification on the RFI deadline? The RFI expresses that we might have a little more time.

Government Response

Refer to RFI amendment.

Question

Would you please provide an approximate timeline for the RFP release?

Government Response

Not requesting RFP at this time.

Question

Can you confirm the RFI timeline is on pause until the government is authorized to return to normal operations? Can you please provide clarity on the due date with the recent Government re-opening?

Government Response

Refer to RFI amendment.

Question

Does the Government contemplate any other engagement with industry prior to releasing a final solicitation such as another RFI, issuing a draft RFP or holding an industry day?

Government Response

Not determined at this time.

Question

Does the Government have an interested parties list? If so, can our company be added to that list? Also, will the Government share that list for teaming purposes?

Government Response

No

Question

We would like clarification regarding the response requirements since the updated RFI. Per section 3 the request is to submit a brief description and Attachment1, yet in section 8 states the response is a white paper with a capability statement.

Government Response

All responses must be captured on Attachment 1 of the RFI. If you have already submitted a response and have not received a request for revision, your submission has been deemed acceptable.

Question Request for Information (RFI) Page 2, Section 7 IAW this statement "If any Responders do not currently possess a Proprietary Data Protection Agreement (PDPA) that would permit the AFLCMC/HNCD support contractors listed below to review and evaluate white papers submitted in response to this RFI, please coordinate with POCs listed in paragraph 4." Can the Government please provide the listing of the support contractors for review? Additionally, the RFI letter does not contain POCs within paragraph 4; please clarify.

Government Response

Please refer to updated RFI letter.

Question

What type of contract would this be drafted as? Time plus Materials, IDIQ, Fixed price – Level of Effort based, etc.?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities only and is self-contained.

Question

Does the Government customer allow for setup of Texas entity post award to allow for Texas local employment?

Government Response

This is an RFI only; no awards are anticipated at this time.

Question

Does the Government need the full name of the Company?

Government Response

Yes.

Question

What is/are the awarded contract number(s) currently supporting ELICSAR efforts?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities only and is self-contained.

Question

Is VALAR intended to replace existing contract(s) or be awarded in addition to existing contract(s)?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities only and is self-contained.

Question

When is the anticipated date a contract award for VALAR will occur?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities only and is self-contained.

Question

When is anticipated date a DRAFT and FINAL RFP for VALAR will be released?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities and is self-contained.

Question

How many Full Time Equivalent (FTE) are currently contracted to support ELICSAR efforts today?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities and is self-contained.

Question

How many contracted Full Time Equivalent (FTE) are planned to support ELICSAR VALAR efforts?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities and is self-contained.

Question

What is the FY25 funding value of contracted ELICSAR efforts?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities and is self-contained.

Question

What is the estimated FY26 funding value of contracted ELICSAR VALAR efforts?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities and is self-contained.

Question This Request for Information (RFI) aims to gather information on industry capabilities and is self-contained.

Can the Government confirm submissions should be submitted in excel (only) to the listed CO and CS provided?

Government Response

All responses must be captured on Attachment 1 of the RFI. If you have already submitted a response and have not received a request for revision, your submission has been deemed acceptable.

Question Reference - Updated RFI letter, Section 3b Requested Information & Section 8 Responses In addition to submitting the 5-page capabilities statement, does the government still want respondents to submit the Attachment 1 Excel spreadsheet?

Government Response

All responses must be captured on Attachment 1 of the RFI. If you have already submitted a response and have not received a request for revision, your submission has been deemed acceptable.

Question RFI Section 2 (Purpose), “Data Fabric to support CSOS mission” For the Data Fabric supporting the Cyberspace Operations System (CSOS), will the Government confirm expected data volume ranges and performance targets across classification domains so we can align architecture and scaling appropriately?

Government Response

Petabytes of daily data, text based and PCAP.

Question RFI Section 2 (Purpose) “Cloud Infrastructure” The RFI does not specify the exact cloud environment or existing infrastructure, this vendor assumes ELISCAR will run on CloudOne. Please confirm this is correct or the infrastructure ELICSAR will run on if different.

Government Response

Currently AWS.

Question RFI Section 2 (Purpose) “Data Scale and Sources” What are the current data ingestion rates (e.g. GBs/day) and what new data sources are planned?

Government Response

Our organization maintains a scalable ingestion framework designed to meet mission requirements and adapt to evolving operational needs.

Question RFI Section 2 (Purpose) “Configuration Management” To what extent is the client committed to Apache NiFi and N8N? Are alternative workflow tools acceptable?

Government Response

Commitments are based on current AF software licensing agreements and network approvals. Future tools will be evaluated if required.

Question RFI Section 1 (Background), “Interoperability with LEAP-LTAC edge analytics” Are there preferred interoperability standards or protocols for seamless integration between ELICSAR and LEAP‑LTAC edge analytics within the IDCS architecture?

Government Response

In line with government regulations, currently in Schema 1 format.

Question RFI Section 2 (Purpose), “Cloud-native approach” Will the Government confirm whether the solution should be cloud‑provider agnostic or optimized for a specific CSP (e.g., AWS GovCloud, Azure Government)?

Government Response

Not available at this time.

Question RFI Section 2 (Purpose), “Zero Trust principles” Is Zero Trust implementation expected to align fully with DoD CIO Zero Trust Reference Architecture v2.0, and are there priority capability pillars for initial deployment?

Government Response

Yes.

Question RFI Section 3 (Requested Information), “Integration and testing” Will the Government provide a controlled test environment for integration, security validation, and performance benchmarking prior to production deployment?

Government Response

The government will sponsor a test environment.

Question Section 3 (Requested Information) Will work be performed entirely on‑site at Joint Base San Antonio or will hybrid/on‑site/remote execution models be acceptable for certain functions?

Government Response

Hybrid/on-site/remote is acceptable.

Question RFI Section 6 (Demonstration Opportunity) For the optional demonstration, will the Government provide anticipated scenarios or representative datasets so we can tailor our capability showcase to operational priorities?

Government Response

Will be determined at a later time.

Question RFI Section 2 (Purpose) To further advance mission capabilities, is the Government open to evaluating enhanced technologies that can improve operational effectiveness in log ingestion, cyber situational awareness, and AI‑driven optimizations within the ELICSAR environment?

Government Response

Potentially.

Question

Can the Government provide additional details on the current technical baseline for the existing ELICSAR Big Data Platform (BDP), including the hosting environment (e.g., AWS GovCloud, MilCloud 2.0, Azure IL6) and primary analytic or data management tools currently in use (e.g., NiFi, N8N, Elasticsearch, Kibana)?

Government Response

The baseline is JCRS-D. Currently AWS and associated CSP tools.

Question

Can the Government confirm which versions of Apache NiFi and N8N are currently implemented within the ELICSAR environment?

Government Response

The latest versions of Apache NiFi and N8N are implemented.

Question

Can the Government elaborate on the intended architecture or existing data model constraints for the Data Fabric supporting the Cyberspace Operations System (CSOS)?

Government Response

Not available at this time.

Question

Is the Government seeking solutions that can replace or enhance existing ELICSAR analytics and visualization tools (e.g., Kibana, Grafana, Splunk)?

Government Response

Not currently.

Question

How does ELICSAR currently interoperate with LEAP/LTAC edge systems — are data synchronization and transport requirements defined or flexible?

Government Response

Transport requirements are defined.

Question

Will solutions be required to demonstrate compliance with Zero Trust Architecture (ZTA) principles, and if so, which framework (e.g., NIST 800-207)?

Government Response

Yes, NIST framework.

Question

Are there specific cross-domain solution (CDS) tools currently in use for data sharing across classification levels?

Government Response

Our organization employs cross‑domain capabilities that are fully aligned with U.S. Government security policies and approved CDS frameworks.

Question

The RFI mentions development of a “comprehensive Data Fabric” to support the Cyberspace Operations System (CSOS). Will the Government provide reference architectures or standards (e.g., JCWA interface specifications) to guide interoperability expectations?

Government Response

Yes, architecture requirements will be delivered to the working vendor.

Question

Are there specific performance metrics or KPIs (e.g., data ingestion rate, query latency) that the Government is most interested in measuring for ELICSAR?

Government Response

Data ingest rate, latency, and data compression rates.

Question

Does the Government intend the future solicitation to focus primarily on sustainment of the existing platform, or is it seeking proposals that include modernization or innovation (e.g., migration to cloud-native architecture or new data fabric design)?

Government Response

Potentially.

Question

Will the Government provide existing API documentation or data interface standards for ELICSAR and LEAP-T (LTAC) interoperability within the Integrated Defensive Cyber System (IDCS)?

Government Response

Yes, to the working vendor.

Question Attachment 1, RFI Excel Template, Instructions for Comments and Examples The instructions ask the vendor to limit each response to no more than 600 characters. We are using Word to check character counts. Would the Government please state if there is a preference for vendors to count spaces, or not, in the character count?

Government Response

No preference.

Question RFI Letter § 2 – Data Fabric & Tooling Beyond Apache NiFi and n8n, are there mandated or preferred components (e.g., Kafka, Flink, Spark, Elastic, OpenSearch, Grafana) for the Data Fabric, querying, visualization, and collaboration toolset? Please identify any license constraints and Government-furnished software.

Government Response

Kafka has been used in the past and may be used in the future.

Question RFI Letter § 2 – Cloud-Native Optimization Which cloud environments and IL levels are in-scope (e.g., AWS GovCloud IL4/5, Azure Government IL5/6, on-prem private cloud)? Are managed services permissible (e.g., MSK, OpenSearch Service), and are there restrictions on PaaS/SaaS usage for mission data?

Government Response

AWS is the current cloud solution. The government may change solutions.

Question RFI Letter § 1 & § 2; JCWA/UP/IDCS Interoperability Please elaborate on required interfaces and data contracts between ELICSAR (UP BDP), LEAP–LTAC edge nodes, and the Integrated Defensive Cyber System (IDCS), including transport protocols, metadata schemas, and cross-domain solution (CDS) expectations.

Government Response

Not disclosed at this time.

Question RFI Letter § 2 – Multi-Domain Operations

What are the performance, latency, and data-freshness targets for ingestion/analytics across Unclassified and Classified domains? Are there specific throughput SLAs (e.g., events/sec, GB/day) or query response SLOs that respondents should address?

Government Response

Not disclosed at this time.

Question RFI Letter § 2 – Security & Compliance

Please confirm applicable cybersecurity baselines and control overlays (e.g., DoD Cloud SRG, DISA STIGs, CNSSI 1253, Zero Trust Reference Architecture) and any specific logging/telemetry compliance (e.g., ENS/EDR integrations, audit retention minima).

Government Response

All are subject to change.

Question RFI Letter § 2 – Data Management & Governance

Are there mandated schemas, ontologies, or standards (e.g., UCO, STIX/TAXII, OpenC2) for cyber event data, and should proposals include data catalog, lineage, and policy-driven access controls?

Government Response

No.

Question RFI Letter § 2 – Development & Sustainment

Please clarify expectations around CI/CD, infrastructure-as-code, and test automation. Should respondents assume Git-based workflows, container registries, SBOM generation (e.g., CycloneDX), and supply-chain security controls (e.g., SLSA level targets)?

Government Response

Git Lab and Docker are used.

Question Attachment 1 – Corporate Experience

For project references, what recency window applies (e.g., last 3–5 years)? Are subcontractor/partner experience and joint ventures acceptable, and how should roles and percentage of effort be indicated?

Government Response

All project references will be taken into consideration as well as subcontractor/partner experience

Question CUI & Proprietary Markings (§ 7, § 8) Please confirm marking conventions for CUI and proprietary content (banner/footer text, portion markings, distribution statements) and whether a PDPA is required for support contractors to review proprietary data.

Government Response

CUI and Classified data must be properly marked. Refer to updated RFI.

Question Metrics & KPIs Are there baseline operational KPIs for ELICSAR today (e.g., data ingest volume, node counts, uptime) that respondents should address for improvements, and are there target benchmarks for future state?

Government Response

Not disclosed at this time.

Question Attachment 1, Section 2 Will the Government expect contractors to provide software development and sustainment of the existing ELICSAR code base, or primarily integration and orchestration of existing tools into ELICSAR?

Government Response

All possibilities will be considered.

Question Attachment 1, Section 3 Are there specific encryption or cross-domain transfer mechanisms the Government prefers?

Government Response

No.

Question Attachment 1, Section 7, Question 67 Clarification on whether this question refers to the clearance level of personnel within the company that can support NIPR/SIPR/JWICS/SAP environments?

Government Response

Personnel must be able to perform work with all the above clearance levels.

Question

Does the Government need the Vendor to provide the solution of the platform and selected (CSP) Cloud Solution Provider? IE: AWS GovCloud High Baseline

Government Response

No.

Question

If “No” to question (1.) above, please provide the CSP high baseline CSP of which the intended scope of work shall be produced within.

Government Response

Not disclosed at this time.

Question Attach 1, Part II-Capability Survey, Section III. Security & Compliance, row 28, Company experience creating and maintaining Authorization to Operate (ATO) across multiple domains Will the Government consider this condition met if the experience creating and maintaining an ATO across multiple domains is those for NIPRNet and SIPRNet enclaves? If not, please provide an example of one that does.

Government Response

We will take into consideration.

Question Attach 1, Part II-Capability Survey, Section III. Security & Compliance, row 30, Company CMMC Level 2 compliance How will the Government evaluate a proposal when a company’s CMMC Level 2 journey is complete up to and including an official assessment that is in progress with a C3PAO accredited by the CMMC Accreditation Body (CMMC-AB), but the C3PAO has not issued the certification?

Government Response

This Request for Information (RFI) aims to gather information on industry capabilities only and is self-contained.

Question Attachment 1, RFI Excel Template, Row 76.

The question asks about “experience” with CSDS, CDRL and DID. By “experience”, would the Government please clarify if this means the activity of developing and delivering these artifacts as part of a technical delivery, or does “experience” mean the activity of managing these lists in a SETA capacity on behalf of a Government program?

Government Response

Developing and delivering as part of delivery.

Question Attachment 1, RFI Excel Template, Row 36 Would the Government please clarify if there is an anticipated staffing requirement for OCONUS places of performance? Or does this question refer to temporary travel to, or remote support to, OCONUS locations?

Government Response

Yes, this will be some permanent onsite position requirement for the OCONUS region.